QMI - QUALCOMM

1、ConfidentialPA112/1/20111ConfidentialPA112/1/20111QMI - QUALCOMM MSM Interface on CSFBModem RIL - Dai ErxinConfidentialPA112/1/20112ConfidentialPA112/1/20112AgendaAMSS QMI OverviewAMSS QMI INITAMSS QMI RxAMSS QMI TxAMSS QMI data structureAndroid QMI OverviewAndroid QMI QMUXD INITAndroid QMI QMUXD Rx

2、 From ClientAndroid QMI QMUXD Rx From AMSSAndroid QMI QMUX Client INITAndroid QMI QMUX Client RxAndroid QMI QMUX Client TxAndroid QMI PROXY INITAndroid QMI PORXY RxAndroid QMI PROXY TxQMI QMUX Frame FormatQMI EvolutionQMI IDLConfidentialPA112/1/20113ConfidentialPA112/1/20113AMSS QMI Overview Refer 8

3、0-VR459-1_B_QMI_Framework_Overview.pdfConfidentialPA112/1/20114ConfidentialPA112/1/20114AMSS QMI OverviewQMI WDSQMI DMSQMI NASQMI TransportQCTLQMUXSIOInterconnect driverLogical device(s)TERAW IP or 802.3 MACControl Control I/OData I/OInterconnectConfidentialPA112/1/20115AMSS QMI INIT1.Read port conf

4、iguration from NV(6873) or use default configrationOn fujiR2, no nv configuration. So use default configration through function ds_qmux.c:qmuxi_set_default_port_configurationDefined FEATURE_DATA_FUSION_MDM / FEATURE_DATA_FUSION_CSFBFUSION_MDM configuration: Support 8 SDIO ports for embedded calls an

5、d 1 USB A2 port for embedded callsQMUX_SET_DEFAULT_DEVICE_CONFIG( index, QMI_DEV_SDIO_MUX_A2_0, QMI_DEV_SDIO_MUX_A2_0);QMUX_SET_DEFAULT_DEVICE_CONFIG( index, QMI_DEV_SDIO_MUX_A2_8, QMI_DEV_SDIO_MUX_A2_8);ConfidentialPA112/1/20116AMSS QMI INIT#define QMUX_SET_DEFAULT_DEVICE_CONFIGqmux_state 0.8 .io.p

6、ort_info.qmi_port; /QMI_DEV_SDIO_MUX_A2_0(0 x600) . QMI_DEV_SDIO_MUX_A2_7(0 x608)qmux_state 0.8 .io.port_info.data_port; / QMI_DEV_SDIO_MUX_A2_0(0 x600) . QMI_DEV_SDIO_MUX_A2_7(0 x608)qmux_state 0.8 .io.port_info.qmi_stream; /QMUX_DEVSTREAM_CONTROLqmux_state 0.8 .io.port_info.frame_mode;/QMUX_FRAME_

7、MODE_NONEConfidentialPA112/1/20117AMSS QMI INIT2. registers the configured ports with SIO Runtime Device Mapper (RDM) This step will open the SIO port.ConfidentialPA112/1/20118AMSS QMI INIT3.Initialize the control stream Rx and Tx watermarks for every qmi instanceThe Tx/Rx watermark is in qmux_state

8、. &qmux_state 0.8 -io.rx_wm and &qmux_state 0.8 -io.tx_wmRegister sio callback ds_qmux.c:qmuxi_sio_rx_cb. Also link into qmux_state:&qmux_state 0.8 -io.rx_wm.each_enqueue_func_ptr = qmuxi_sio_rx_cb; ConfidentialPA112/1/20119AMSS QMI INIT4.Register control service(QMUX_SERVICE_CTL) with q

9、mux instance. The configuration info is in qmi_ctl_cfgqmi_inst 0.8.The qmi_ctl_cfgqmi_inst 0.8 is copied into &qmux_state 0.8 .serviceQMUX_SERVICE_CTL.cfg through function qmux_reg_service(qmi_inst, QMUX_SERVICE_CTL, &qmi_ctl_cfgqmi_inst)What is in qmi_ctl_cfgqmi_inst 0.8? qmi_ctl_cfgqmi_ins

10、t.cbs.recv = qmi_ctli_recv; Callback function for processing control service command from client(Linux side)Command tablestatic qmi_ctli_cmd_hdlr_type qmi_ctl_cmd_callbacksQMI_CTL_CMD_MAX = QMI_CTL_HDLR(QMI_CTLI_CMD_VAL_SET_INSTANCE_ID,qmi_ctli_set_instance_id),QMI_CTL_HDLR(QMI_CTLI_CMD_VAL_GET_VERS

11、ION, qmi_ctli_get_version ),QMI_CTL_HDLR(QMI_CTLI_CMD_VAL_GET_CLIENT_ID, qmi_ctli_get_client_id ),;ConfidentialPA112/1/201110AMSS QMI INIT5.Initialize all other QMI service besides qmi control service(QMUX_SERVICE_CTL)Follwing qmi service is initialized: WDS(Wireless Data Service) / DMS(Device Manag

12、ement service) / NAS(Network Access service) / QOS / PDS(Position Determination Service) / AUTH / WMS(Wireless Message Service) / AT(Atcop Service) / VOICE / PBM(Phone Book Manager) / CAT(Card Application Toolkit Service) / UIM / SSAR Every service have its own configuration: qmi_xxxi_cfgqmi_inst 0.

13、8 xxx is WDS DMS NAS QOS PDS AUTH AT VOICE PBM CAT UIM SAR The configuration register with qmux instance through function qmux_reg_service(qmi_inst, QMUX_SERVICE_XXX, &qmi_xxx_cfgqmi_inst). The configuration data is copied into &qmux_state 0.8 .serviceQMUX_SERVICE_XXX.cfg correspondingly.Wha

14、t is in qmi_xxx_cfgqmi_inst 0.8? The receive data callback function(Refer call flow chart).Command table: qmi_xxx_cmd_callbacksConfidentialPA112/1/201111AMSS QMI INITAfter register the qmi_xxxi_cfgqmi_inst 0.8 with qmux_state 0.8 . Every QMI service also create the client transactions single list an

15、d command buffer single list. The 2 lists is very important for data transfer between qmux server(AMSS side) with qmux client(Linux side). AMSS implement the common interface for creating such single list. Refer Queue.c (modem_proccoreservicesutilssrc)From amss_qmi_datastructure.pdf, we can see ever

16、y qmi service state structrue have a qmi_common_client_state_type common field. In qmi_common_client_state_type, it have 2 arraies. One is for transaction and the other is for command buffer.qmi_transaction_type transactionsMAX_PENDING_TRANSACTIONS(15);qmi_cmd_buf_type cmd_bufMAX_PENDING_COMMANDS(18

17、);The single list is for above 2 arrays.ConfidentialPA112/1/201112All QMI services do below process in the corresponding init function: (void) q_init( &cl_sp-common.x_free_q );AMSS QMI INITx_free_qlink*next_ptr*prev_ptrConfidentialPA112/1/201113AMSS QMI INITx_p = &cl_sp-common.transactions0;

18、for (i=MAX_PENDING_TRANSACTIONS(15); i; i-, x_p+ ) (void) q_link( x_p, &x_p-link ); q_put( &cl_sp-common.x_free_q, &x_p-link );x_free_qlink*next_ptr*prev_ptrx_free_qlink*next_ptr*prev_ptrtransactions0link*next_ptr*prev_ptrtransactions0link*next_ptr*prev_ptrtransactions1link*next_ptr*prev

19、_ptrConfidentialPA112/1/201114AMSS QMI INIT6.Initialize the QMI interface layer. This layer contains all the logic required for QMI subsystem to interface with external modules, and vice versa. The QMI is just a communication channel. For exchaning the protocol system informations, QMI must be conne

20、cted with protocol system. To archiving this, QMI work as CM client. Refer call flow chart.ConfidentialPA112/1/201115AMSS QMI INIT7. Set process function qmuxi_process_rx_sig() for signal DCC_QMUX_RX_SIGNAL. Once SIO receive the data, qmuxi_sio_rx_cb() function will be called. qmuxi_sio_rx_cb() will

21、 signal DCC_QMUX_RX_SIGNAL. Then qmuxi_process_rx_sig() will be called. Refer amss_qmi_rx call flow.ConfidentialPA112/1/201116AMSS QMI INIT8.Set internal command process function. In step 6, QMI register callback function into CM. Once the callback function called, it do not process the info directl

22、y. It send the corresponding command. The command is processed by the command process function. (void) dcc_set_cmd_handler(DCC_QMI_CMD, qmi_process_cmd); (void) dcc_set_cmd_handler(DCC_QMI_CHARGER_CMD, qmi_charger_process_cmd); #ifndef FEATURE_NO_QMI_VOICE (void) dcc_set_cmd_handler(DCC_QMI_VOICE_CM

23、_IF_CMD, qmi_voice_cm_if_process_cmd); (void) dcc_set_cmd_handler(DCC_QMI_VOICE_CMD, qmi_voice_process_cmd); #endif/* FEATURE_NO_QMI_VOICE */ (void) dcc_set_cmd_handler(DCC_QMI_PBM_CMD, qmi_pbm_process_cmd); (void) dcc_set_cmd_handler(DCC_QMI_PBM_IF_CMD, qmi_pbm_if_process_cmd);ConfidentialPA112/1/2

24、01117AMSS QMI Rx1.When AMSS QMUX receive the data from SIO, The QMUX process function ds_qmux.c:qmuxi_process_rx_sig() will traverse all qmux instance from QMI_INSTANCE_MIN(0) to QMI_INSTANCE_MAX(11). It will check the rx watermark (&qmux_stateqmi_inst-io.rx_wm) to determine which qmi instance h

25、ave data. Refer amss_qmi_rx. ConfidentialPA112/1/201118AMSS QMI RxIf no data on the qmi instance, you will see the qxdm log:MSG 05000/01 Data Services/Medium 07:17:35.702 ds_qmux.c 02126 Received QMUX PDU (12 bytes) on QMI link 0MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pendi

26、ng commands on QMUX link 1MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMUX link 2MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMUX link 3MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending comman

27、ds on QMUX link 4MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMUX link 5MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMUX link 6MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMU

28、X link 7MSG 05000/01 Data Services/Medium 07:17:35.703 ds_qmux.c 01757 No pending commands on QMUX link 8ConfidentialPA112/1/201119AMSS QMI Rx2.static void qmuxi_process_msg ( qmux_state_type *qmux_s, dsm_item_type *qmux_pdu) qmi_log_packet(qmux_pdu, qmi_instance_by_qmux_handle( qmux_s-service ), QM

29、UX_RX);QXDM Log: LOG 0 x1390 QMI Link 2 RX PDU 07:18:49.762 Length: 0038 0 x138E + 2(link) + 0(Rx) = 0 x1390ConfidentialPA112/1/201120AMSS QMI Rx2011 Nov 22 07:18:49.763 69 0 x1390 QMI Link 2 RX PDUIFType = 1QmiLength = 37QmiCtlFlags = 0QmiType = WDSClientId = 2SduCtlFlags = REQTxId = 1174MsgType =

30、QMI_WDS_START_NETWORK_INTERFACE_MSGMsgLength = 25QmiWdsStartNetworkInterface QmiWdsStartNetworkInterfaceReqTlvs0 Type = 49 Length = 1 ConfiguredProfileId3gppTlv ProfileIndex = 1 QmiWdsStartNetworkInterfaceReqTlvs1 Type = 20 Length = 3 ApnNameTlv ApnName = pta ConfidentialPA112/1/201121AMSS QMI RxQmi

31、WdsStartNetworkInterfaceReqTlvs2 Type = 25 Length = 1 IpFamailyPref IP Family Preference = IPv4 QmiWdsStartNetworkInterfaceReqTlvs3 Type = 254 Length = 4 DefaultTlv Data = 0 x00, 0 xFF, 0 xFF, 0 x03 QmiWdsStartNetworkInterfaceReqTlvs4 Type = 53 Length = 1 CallTypeIdentifiler Call Type = EMBEDDED CAL

32、L ConfidentialPA112/1/201122AMSS QMI Rx3.If have QMI service specific receive callback function, it will be called. Otherwise the common service receive callback function is called. In this function, it will get a transaction data structure(x_p) from the transaction single list(x_free_q). And then p

33、arse the SDU received from SIO, extract out every command(One transaction support multiple commands) from the SDU and assign one command buffer(get from the command buffer single list cmd_free_q) for the command. The command buffer will be assigned into: x_p-cmd_listx_p-n_cmds = cmd_buf_p;Confidenti

34、alPA112/1/201123AMSS QMI Rxx_free_qlink*next_ptr*prev_ptrtransactions0link*next_ptr*prev_ptrtransactions1link*next_ptr*prev_ptrcmd_free_qlink*next_ptr*prev_ptrcmd_buf0link*next_ptr*prev_ptrCmd_buf1link*next_ptr*prev_ptrcmd_list3ConfidentialPA112/1/201124AMSS QMI Tx Applies current power save mode in

35、dication filter to specified message. When in power save mode, all responses are filtered to avoid waking up client processor. Clients are expected to ensure there are no pending transactions before entering power save mode. The response is not sent until all responses are sent by command hdlrsConfi

36、dentialPA112/1/201125AMSS QMI Tx2 types Tx Response Indicationvoid qmux_send(void *service_handle, dsm_item_type *qmux_sdu, byte clid)qmi_log_packet(qmux_sdu, qmi_instance, QMUX_TX);QXDM Log:LOG 0 x1391 QMI Link 2 TX PDU 07:18:52.829 Length: 00220 x138E + 2(link) + 1(Tx) = 0 x1391ConfidentialPA112/1

37、/201126AMSS QMI Tx2011 Nov 22 07:18:52.830 BB 0 x1391 QMI Link 2 TX PDUIFType = 1QmiLength = 21QmiCtlFlags = 128QmiType = WDSClientId = 255SduCtlFlags = INDTxId = 0MsgType = QMI_WDS_GET_PKT_SRVC_STATUS_MSGMsgLength = 9QmiWdsGetPktSrvcStatus QmiWdsPktSrvcStatusIndTlvs0 Type = 1 Length = 2 PktSrvcStat

38、usTlv ConnectionStatus = QMI_WDS_PKT_DATA_CONNECTED ReconfigurationRequired = NOT_REQUIRED ConfidentialPA112/1/201127AMSS QMI TxQmiWdsPktSrvcStatusIndTlvs1 Type = 18 Length = 1 IpFamily IP Family = IPV4_ADDR ConfidentialPA112/1/201128AMSS QMI data structureRefer amss_qmi_datastructure.pdfQMUX works

39、base on the static qmux_state_type qmux_stateQMI_INSTANCE_MAX;Every QMI service works base on the specific service state: qmi_xxxi_state_typestatic qmi_ctli_state_type qmi_ctl_stateQMI_INSTANCE_MAX;static qmi_ati_state_type qmi_at_stateQMI_INSTANCE_MAX;static qmi_authi_state_type qmi_auth_stateQMI_I

40、NSTANCE_MAX ;static qmi_dmsi_state_type qmi_dms_stateQMI_INSTANCE_MAX;static qmi_qosi_state_type qmi_qos_stateQOSI_MAX_STATEQMI_INSTANCE_MAX;static qmi_wdsi_state_type qmi_wds_stateWDSI_MAX_STATEQMI_INSTANCE_MAX;static qmi_cati_state_type qmi_cat_stateQMI_INSTANCE_MAX;static qmi_nasi_state_type qmi_

41、nas_stateQMI_INSTANCE_MAX;static qmi_pbmi_state_type qmi_pbm_stateQMI_INSTANCE_MAX;static qmi_pdsi_state_type qmi_pds_stateQMI_INSTANCE_MAX ;static qmi_sar_service_state_type qmi_SSAR_stateQMI_INSTANCE_MAX;static qmi_uimi_state_type qmi_uim_stateQMI_INSTANCE_MAX;static qmi_voicei_state_type qmi_voic

42、e_stateQMI_INSTANCE_MAX;static qmi_wmsi_state_type qmi_wms_stateQMI_INSTANCE_MAX;ConfidentialPA112/1/201129AMSS QMI data structureAll qmi_xxxi_state_type have similar structuretypedef struct qmi_xxxi_state_s/ must be first since we aliasqmi_common_svc_state_type common; qmi_xxxi_client_state_type cl

43、ientXXXI_MAX_CLIDS; qmi_wmsi_state_type;All qmi_xxxi_client_state_type have similar sturcturetypedef struct qmi_xxxi_client_state_s / must be first since we aliasqmi_common_client_state_type common; / Service specific data qmi_wmsi_client_state_type;Different QMI service support different amount of

44、clientATI_MAX_CLIDS(1) AUTHI_MAX_CLIDS(5) DMSI_MAX_CLIDS(7)QOSI_MAX_CLIDS(4) WDSI_MAX_CLIDS(7) CATI_MAX_CLIDS(7)NASI_MAX_CLIDS(7) PBMI_MAX_CLIDS(3) PDSI_MAX_CLIDS(7)SSAR_MAX_CLIDS(7) VOICEI_MAX_CLIDS(3) WMSI_MAX_CLIDS(7)ConfidentialPA112/1/201130Android QMI Overview QMUXD Client - RILD Act as a QMUX

45、D client and QMI proxy service client for NAS / VOICE / DMS / PBM/ WMS / SAR. QMUXD client correspond to QMUXD. QMI proxy service client correspond to QMI proxy service. RILD(QCRIL i.e. QMI proxy service client) send QMI request to AMSS QMI service through QMUXD and QMIProxy. RILD send the QMI reque

46、st in main thread through the socket connect(proxy connection) to QMUXD RILD receive the indication and QMI request response from QMUXD through socket connect(proxy connection) in separate RX thread.ConfidentialPA112/1/201131Android QMI Overview QMUXD Main thread: Receive QMI request from QMUXD clie

47、nt(RILD NETMGRD ATCOMD QMIProxy) through socket. And then write the QMI request through another socket to QMI proxy for NAS/WMS/DMS/PBM/SAR/VOICE or write to SDIO device for other service e.g. WDS. RX thread for RMNET SDIO connection: QMUXD have separate RX thread for receiving response and indicati

48、on from AMSS through SDIO device. RX thread for QMI proxy: QMUXD have separate RX thread for receiving response and indication(The data comes from AMSS-qmuxd) from QMI proxy through socket(proxy_qmux_ client_socket).ConfidentialPA112/1/201132Android QMI Overview QMI Proxy Supports different Radio Ac

49、cess Technology (RAT) simultaneously on split modem architecture. E.g. FujiR2 8260 + 9200. Arbitration intelligence controls Voice, SMS, IMS, and SIM on the local modem and the remote modem QMI proxy is a new software component. Designed to own the fused solution arbitration intelligence. First laun

50、ched in SVLTE Type II QMI Proxy receive QMI request from QMUXD in main thread through. QMI Proxy receive AMSS data from QMUXD in separate Rx thread. QMI Proxy work as a QMUXD client and become a QMI service client using SDIO connection.ConfidentialPA112/1/201133Android QMI Overview QMI ProxyNote1: T

51、he data arbitration is in the remote modem.Note2: UIM and CAT are only located in the remote modem.ServicesUsing QMI proxyNot using QMI proxyDMSYESNASYESVoiceYESWMSYESPBMYESSARYESDataYES(note1)UIMYES(note2)CATYES(note2)ConfidentialPA112/1/201134Android QMI Overview QMI Proxy Base Band: CSFBSerivesLo

52、cal Modem(8260)Remote Modem(9200)DMSNOYESNASNOYESVOICENOYESWMSNOYESPBMNOYESSARNOYESConfidentialPA112/1/201135Android QMI Overview QMI Proxy Base Band: SVLTE2ServicesLocal Modem(?)Remote Modem(?)DMSYESYESNASYESYESVOICEYESNOWMSYESYESPBMNOYESSARYESYESConfidentialPA112/1/201136Android QMI OverviewQMUXDC

53、lient 2 of QMUXD(Such as NETMGRD)Client n of QMUXD.QMUXD SOCKET 1QMUXD SOCKET 2QMUXD SOCKET nQMI Proxy SOCKETQMUXD SOCKET mAMSSQMI ProxySDIO(/dev/sdioctl0)Client 1 of QMUXD (Such as RILD)ConfidentialPA112/1/201137Android QMI OverviewConfidentialPA112/1/201138Android QMI QMUXD INIT1. Set the callback

54、 function qmi_qmux_rx_msg() to SDIO receive thread linux_qmi_qmux_io_rx_msg(), this thread is for receiving data from AMSS side through SDIO device.2. Read sysfs to omit opening of the qmi connections that are used by other clients (like usb rmnet)3. Disable non-SDIO ports if the “ro.baseband” is “c

55、sfb”ConfidentialPA112/1/201139Android QMI QMUXD INIT4.Open the allowed connection() in connection table linux_qmi_conn_id_enablement_array. If do not support QMI Proxy(ro.baseband is not “csfb” or “svlte2a”), it do not open the QMI_CONN_ID_PROXY connection which is the last connection in the connect

56、ion table. On FujiR2, it need open QMI_CONN_ID_PROXY connection. The open connection include below work:a)If the connection is not proxy connection, open the device directly in the connection info table linux_qmi_qmux_io_conn_info. If the connection is proxy connection, create the proxy_qmux_client_

57、socket and connect to QMI proxy daemon. From this point of view, QMUXD is a client of QMI Proxy daemon.linux_qmi_conn_id_enablement_arrayQMI_MAX_CONNECTIONS(19)-2 = ,SDIO_DATA1_CNTL,QMI_CONN_ID_RMNET_SDIO_0(8),TRUE,;linux_qmi_qmux_io_conn_infoQMI_MAX_CONNECTIONS(19) = , /dev/sdioctl0, , Confidential

58、PA112/1/201140Android QMI QMUXD INITb)Create thread linux_qmi_qmux_io_rx_msg(), this thread is for receiving data from AMSS side through SDIO device.5.In qmuxd main thread while(1) loop, create server socket “qmux_connect_socket” and listen client(rild / netmgrd /qmi proxy ) connect request. It also

59、 invoke linux_qmi_qmux_if_server_process_client_msg() to process data from the client.6.Summarize qmuxd init, it open all the allowed connection device. It create 2 sockets. One is for qmuxd work as a qmux server. The other is the client socket to connect to qmi proxy. It create 1+X receive threads.

60、 Main thread(1) is for receiving data from qmuxd client(rild / netmgrd / qmi proxy). The others(X) are for receiving data from AMSS or qmi proxy. X depends on how many connections we have. Every connection read data from different devices(hardware or socket for qmi proxy)ConfidentialPA112/1/201141Android QMI QMUXD INIT7.There are 3 important dat